Docs
Connect an agent
in one command.
OneDroid Synapse is a governed MCP gateway: your agents connect to one URL, and every tool call is authenticated, policy-checked and written to an audit log you own. This page gets Claude Code talking to it.
Getting started
Sign in, choose where your data lives, create a hub.
Onboarding is two screens. Only the first carries any weight.
1. Sign in
Go to synapse.onedroid.ai and click Sign in. Three options: Google, Microsoft, or an email address. First time here, use Sign up instead.
Use the same method every time. Sign-in is handled by Clerk, and signing in with Google when you originally signed up with Microsoft creates a separate account — even with the identical email address. If you end up signed in with no hub, or the wrong one, this is almost always why.
2. Choose where your data is stored
Both options are fully supported. Pick based on whether you need to own the database. You can change it later under Manage → Database.
OneDroid Managed
One click, nothing to configure. Tables are created on OneDroid's infrastructure. Best for getting started, evaluating, and teams with no data-residency constraint.
Bring your own database
Paste a connection string and password. Every table is created in your database — Supabase, Neon, or any PostgreSQL 15+. If you stop using OneDroid, the data simply stays where it already was.
The one mistake everybody makes. Leave the literal
[YOUR-PASSWORD] placeholder in the connection string exactly as it
appears. Do not substitute your real password. OneDroid Synapse splices the password in from
the separate field at connection time, which is why it is never stored in the URI.
Pasting the real password into the string is the single most common failure in this
flow, and it presents as "credentials look right but TEST CONNECTION fails".
From Supabase, take Connect → Transaction pooler → URI, not the direct connection. Click Test connection and wait for it to succeed before clicking Next — a bad string then surfaces here rather than after your hub exists.
3. Create your hub
A hub is your workspace: it holds your connections, your team and your permissions. Give it a name and click Create hub.
Your slug will not be what you typed. OneDroid Synapse appends a short
unique suffix, so team-dev-1 becomes something like
team-dev-1-dj8p87. Take the real slug from the browser URL or the
Hub Details panel before you bookmark or share a link.
4. Find your way around
You land on the dashboard. A fresh hub shows 1 member, 1 group and zero connections — that is expected, not a failure. The left nav splits four ways: Overview (status and the getting-started checklist), Connect (connections, AI clients, tools, packs), Manage (members, groups, API tokens, database), and Admin (tool toggles, sharing, invites, activity logs, reporting).
If the connections count stays at zero, an admin has to enable upstream services first under Connect → Connections — members cannot add their own. Once a connection is enabled, each member supplies their own token or OAuth login for it.
Pick your path
Connecting an agent.
Claude Code, CI, or any HTTP client
Use a personal access token and one bearer header. No install, no tunnel, no device-code flow. Start below.
Claude Desktop / Claude.ai web
Connect through an OAuth custom connector in the browser — no token to manage. Ask us for the walkthrough.
Remote tunnels, SSH, containers
If you need state that survives a reconnect, or multi-session token locking, use the tunnel binary with the device-code flow instead of a token. Ask us.
Quickstart
Claude Code, via a personal access token.
1. Create a token
Sign in at synapse.onedroid.ai. Check the hub picker in the top-left is on the hub you want — tokens are bound to one hub and one user, so this choice matters. Then go to Manage → API Tokens and click Create token.
Give it a name you'll recognise later (claude-code-laptop,
ci-nightly) and an expiry. Prefer a bounded lifetime for anything
that isn't on a rotation schedule.
Copy the token before dismissing the dialog. The plaintext is shown once. If you lose it you can Reveal it later from the tokens table, or Rotate to issue a new one — but don't rely on that mid-setup.
2. Add it to Claude Code
claude mcp add \
--transport http \
"synapse" \
https://synapse.onedroid.ai/agent/mcp \
--header "Authorization: Bearer syn_YOUR_TOKEN"
The label synapse is arbitrary. The URL is not — see the note below.
3. Reload, then confirm
MCP servers load at startup, so if you ran that inside a running session, reload the window or open a new one. Then:
claude mcp list
# synapse: https://synapse.onedroid.ai/agent/mcp (HTTP) - ✓ Connected
Or type /mcp in an interactive session — you should see the
synapse entry listing the tools your hub exposes.
4. Prove it works before wiring anything else
This returns HTTP 200 with a JSON-RPC result when the token is good,
401 {"code":"invalid_token"} when it's wrong, and
401 {"code":"missing_token"} when the header didn't arrive:
curl -s https://synapse.onedroid.ai/agent/mcp \
-H "Authorization: Bearer syn_YOUR_TOKEN" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize",
"params":{"protocolVersion":"2025-06-18","capabilities":{},
"clientInfo":{"name":"probe","version":"1.0"}}}'
The one URL detail worth reading
Use /agent/mcp. No hub slug.
A token is bound to a hub when you create it, so
https://synapse.onedroid.ai/agent/mcp resolves that hub server-side —
you never type a slug.
/hub/<slug>/mcp is a different route, used by OAuth clients where
the slug in the path selects the hub. A token can reach it, but only if
the slug matches the hub the token was bound to; a mismatch returns
ERR_SCOPE_UNAVAILABLE. There is no reason to prefer it for a token
client.
Tokens
What a token is, and isn't.
Scope
One user, one hub. Create a separate token per hub you need to reach. Five per user per hub.
Permissions
A token inherits your current role in its hub. It does not freeze your permissions at creation time — downgrade the role and the token loses that access immediately, with nothing to re-issue.
Custody
Stored as a hash plus an encrypted copy so Reveal can work. Rotate invalidates the old token and keeps the remaining lifetime; Revoke kills it with no replacement.
Treat it like a password: password manager or secret store, never chat, git, or a shared doc. If one leaks, Revoke is immediate.
Troubleshooting
The failures people actually hit.
401 missing_token
The header isn't being sent. Check with claude mcp get <name>
and look for the Headers block.
401 invalid_token
Typo, or the token was rotated or revoked. Reveal it from the tokens page and compare, or rotate and reconfigure.
ERR_SCOPE_UNAVAILABLE
You're calling /hub/<slug>/mcp with a slug that doesn't match
the token's hub. Switch to /agent/mcp.
✗ Failed to connect
Run the curl probe first. If curl returns 200 but Claude Code doesn't, it's a header mismatch in the client config, not the token.
A tool says "workspace not found"
Auth is fine — the hub hasn't connected that upstream yet. Add it under Connect → Connections. Authentication and upstream connections are separate things.
404 deep-linking to a settings page
The dashboard uses hash-based routing, so a settings URL pasted into a fresh tab won't resolve. Start at the root and navigate from the sidebar.
Something here wrong or missing?
Tell us and we'll fix the page — michal@onedroid.ai. You'll reach the person who wrote the code. We reply within one business day.